diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml
index 23bd056..f1fcada 100644
--- a/apps/base/cert-manager/kustomization.yaml
+++ b/apps/base/cert-manager/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - serviceaccount.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
+  - vmservicescrape.yaml
diff --git a/apps/base/cert-manager/vmservicescrape.yaml b/apps/base/cert-manager/vmservicescrape.yaml
new file mode 100644
index 0000000..dc9b255
--- /dev/null
+++ b/apps/base/cert-manager/vmservicescrape.yaml
@@ -0,0 +1,17 @@
+---
+# Scrape cert-manager webhook + cainjector metrics endpoints.
+# Picked up by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cert-manager
+  endpoints:
+    - port: metrics
+      path: /metrics
+    - port: http-metrics
+      path: /metrics